45
30
35
45
45
US Finance Under Phishing Pressure: What the SOC Data Reveals?
ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.
ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.
42
30
US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.
A phishing campaign that tricks victims into installing legitimate remote monitoring and management (RMM) software spans 46 countries, with around 45% of observed activity targeting the United States, according to ANY.RUN. Lures include Canada Revenue Agency tax forms, UPS shipping notices, Adobe PDF pages, Social Security Administration themes and invoices, delivered through rapidly rotated Vercel, GitHub Pages and Netlify infrastructure. Researchers identified 425 kit URLs across 240 hosts, 94% of which appeared for only a single day, while stable kit indicators such as font1.woff2 and the secure.html to project/*.zip chain tie the infrastructure together.
55
Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far
TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.
TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.
50
Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users
Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.
Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.
52
45
30
30
30
45
30
30
30
30
30
30
30